masks-server 0.7.0

data/app/models/masks/server/scim/organization_directory.rb

@@ -0,0 +1,70 @@
+module Masks
+  module Server
+    module Scim
+      class OrganizationDirectory < Directory
+        attr_reader :organization
+
+        def initialize(organization)
+          @organization = organization
+        end
+
+        def people
+          Actor.joins(:memberships).merge(organization.memberships.accepted).select("actors.*", "memberships.external_id AS #{ID}")
+        end
+
+        def columns
+          { "externalid" => "memberships.external_id" }
+        end
+
+        def save!(actor, external_id)
+          membership = organization.memberships.find_by(actor: actor) unless actor.new_record?
+          actor.updated_at = Time.current if membership && membership.external_id != external_id
+
+          actor.save!
+
+          membership ||= Members.enroll!(organization, actor, role: Organization::MEMBER, by: nil, provisioned: true, via: "scim")
+          membership.update!(external_id: external_id) unless membership.external_id == external_id
+        end
+
+        def owned(actor_ids)
+          return Set.new if actor_ids.empty?
+
+          elsewhere = Membership.accepted.where(actor_id: actor_ids)
+                                .where("organization_id <> ? OR NOT provisioned", organization.id).distinct.pluck(:actor_id)
+          managers = Actor.where(id: actor_ids - elsewhere).select(&:manages?).map(&:id)
+
+          (actor_ids - elsewhere - managers).to_set
+        end
+
+        def owned!(actor)
+          return if owned([ actor.id ]).any?
+
+          raise Error.new(:forbidden, "#{organization.name}'s directory did not create #{actor.identifier}, or they belong " \
+                                      "elsewhere too, so it can remove them but not change them", scim_type: "mutability")
+        end
+
+        def proven!(actor)
+          return if actor.email.blank? || proven_domains.include?(actor.email.split("@", 2).last)
+
+          raise Error.new(:bad_request, "#{organization.name}'s directory sets only addresses at domains proven for #{organization.name}",
+                          scim_type: "invalidValue")
+        end
+
+        def remove!(actor)
+          membership = organization.memberships.find_by!(actor: actor)
+
+          raise Error.new(:conflict, membership.errors.full_messages.to_sentence, scim_type: "mutability") unless membership.destroy
+
+          Token.live.where(organization: organization, actor: actor).find_each(&:revoke!)
+          Event.record!(Event::MEMBERSHIP_REMOVED, actor: actor, by: nil, organization: organization.key, via: "scim")
+        end
+
+        private
+
+          def proven_domains
+            @proven_domains ||= DomainClaim.verified.where(provider: organization.providers.active).order(:domain).pluck(:domain)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/user.rb

@@ -0,0 +1,149 @@
+module Masks
+  module Server
+    module Scim
+      class User
+        SIMPLE = {
+          "displayName" => :name,
+          "profileUrl" => :profile_url,
+          "locale" => :locale,
+          "timezone" => :zoneinfo,
+          "name.givenName" => :given_name,
+          "name.familyName" => :family_name,
+          "name.middleName" => :middle_name,
+          "name.formatted" => :name
+        }.freeze
+
+        attr_reader :actor, :suspending, :external_id
+
+        def initialize(actor, external_id:)
+          @actor = actor
+          @external_id = external_id
+        end
+
+        def to_h(base:)
+          {
+            "schemas" => [ USER ],
+            "id" => actor.uuid,
+            "externalId" => external_id,
+            "userName" => actor.nickname || actor.email,
+            "name" => {
+              "formatted" => actor.name,
+              "givenName" => actor.given_name,
+              "familyName" => actor.family_name,
+              "middleName" => actor.middle_name
+            }.compact.presence,
+            "displayName" => actor.name,
+            "profileUrl" => actor.profile_url,
+            "locale" => actor.locale,
+            "timezone" => actor.zoneinfo,
+            "active" => !actor.suspended?,
+            "emails" => ([ { "value" => actor.email, "type" => "work", "primary" => true } ] if actor.email),
+            "phoneNumbers" => ([ { "value" => actor.phone, "type" => "mobile" } ] if actor.phone),
+            "photos" => ([ { "value" => actor.picture_url, "type" => "photo" } ] if actor.picture_url),
+            "meta" => {
+              "resourceType" => "User",
+              "created" => actor.created_at&.iso8601,
+              "lastModified" => actor.updated_at&.iso8601,
+              "location" => "#{base}/Users/#{actor.uuid}",
+              "version" => version
+            }
+          }.compact
+        end
+
+        def version
+          %(W/"#{actor.updated_at.to_f}")
+        end
+
+        def replace(document)
+          raise Error.new(:bad_request, "userName is required", scim_type: "invalidValue") if document.to_h["userName"].blank?
+
+          SIMPLE.each_value { |column| actor.public_send(:"#{column}=", nil) }
+          actor.phone = actor.picture_url = nil
+          @external_id = nil
+
+          merge(document)
+        end
+
+        def merge(document)
+          document.to_h.each { |key, value| assign(key.to_s, value) }
+          self
+        end
+
+        def patch(operations)
+          raise Error.new(:bad_request, "a PATCH carries Operations", scim_type: "invalidSyntax") unless operations.is_a?(Array)
+
+          operations.each do |operation|
+            op = operation["op"].to_s.downcase
+            path = operation["path"].presence
+
+            raise Error.new(:bad_request, "#{operation['op']} is not an operation", scim_type: "invalidSyntax") unless %w[add replace remove].include?(op)
+
+            if op == "remove"
+              raise Error.new(:bad_request, "remove needs a path", scim_type: "noTarget") if path.nil?
+
+              assign(path, nil)
+            elsif path
+              assign(path, operation["value"])
+            elsif operation["value"].is_a?(Hash)
+              merge(operation["value"])
+            else
+              raise Error.new(:bad_request, "an operation without a path carries an object", scim_type: "invalidValue")
+            end
+          end
+
+          self
+        end
+
+        private
+
+          def assign(path, value)
+            key = path.sub(/\A#{Regexp.escape(USER)}:/o, "")
+
+            case key
+            when "userName" then user_name!(value)
+            when "active" then active!(value)
+            when "externalId" then @external_id = Actor.normalize_value_for(:external_id, value)
+            when "name" then value.is_a?(Hash) ? value.each { |part, held| assign("name.#{part}", held) } : clear_name
+            when "password" then actor.password = value.presence
+            when /\Aemails(\[.*\])?(\.value)?\z/ then actor.email = first_value(value)
+            when /\AphoneNumbers(\[.*\])?(\.value)?\z/ then actor.phone = first_value(value)
+            when /\Aphotos(\[.*\])?(\.value)?\z/ then actor.picture_url = first_value(value)
+            else
+              column = SIMPLE[key]
+              actor.public_send(:"#{column}=", value.is_a?(String) || value.nil? ? value : value.to_s) if column
+            end
+          end
+
+          def user_name!(value)
+            raise Error.new(:bad_request, "userName is required", scim_type: "invalidValue") if value.blank?
+
+            held = value.to_s.strip
+
+            if held.match?(URI::MailTo::EMAIL_REGEXP)
+              actor.email = held
+              actor.nickname = nil if actor.nickname&.casecmp?(held)
+            else
+              actor.nickname = held
+            end
+          end
+
+          def active!(value)
+            active = ActiveModel::Type::Boolean.new.cast(value.is_a?(String) ? value.downcase : value)
+
+            @suspending = !active
+          end
+
+          def clear_name
+            actor.name = actor.given_name = actor.family_name = actor.middle_name = nil
+          end
+
+          def first_value(value)
+            return value&.to_s&.strip.presence unless value.is_a?(Array)
+
+            chosen = value.find { |entry| entry.is_a?(Hash) && entry["primary"] } || value.first
+            chosen.is_a?(Hash) ? chosen["value"]&.to_s&.strip.presence : chosen&.to_s&.strip.presence
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    module Scim
+      USER = "urn:ietf:params:scim:schemas:core:2.0:User".freeze
+      GROUP = "urn:ietf:params:scim:schemas:core:2.0:Group".freeze
+      LIST = "urn:ietf:params:scim:api:messages:2.0:ListResponse".freeze
+      ERROR = "urn:ietf:params:scim:api:messages:2.0:Error".freeze
+      PATCH = "urn:ietf:params:scim:api:messages:2.0:PatchOp".freeze
+      SERVICE_PROVIDER_CONFIG = "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig".freeze
+      RESOURCE_TYPE = "urn:ietf:params:scim:schemas:core:2.0:ResourceType".freeze
+      SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:Schema".freeze
+      MEDIA_TYPE = "application/scim+json".freeze
+      MAX_RESULTS = 200
+      DEFAULT_COUNT = 100
+
+      class Error < StandardError
+        attr_reader :status, :scim_type
+
+        def initialize(status, detail, scim_type: nil)
+          super(detail)
+
+          @status = status
+          @scim_type = scim_type
+        end
+
+        def to_h
+          {
+            "schemas" => [ ERROR ],
+            "status" => Rack::Utils.status_code(status).to_s,
+            "scimType" => scim_type,
+            "detail" => message
+          }.compact
+        end
+      end
+
+      def self.base(issuer)
+        "#{issuer.url}/scim/v2"
+      end
+    end
+  end
+end

data/app/models/masks/server/scopes.rb

@@ -0,0 +1,128 @@
+module Masks
+  module Server
+    module Scopes
+      OPENID = "openid".freeze
+      PROFILE = "profile".freeze
+      EMAIL = "email".freeze
+      OFFLINE = "offline_access".freeze
+      IDENTITIES = "identities".freeze
+      ORGANIZATION = "organization".freeze
+      GROUPS = "groups".freeze
+      MANAGE = "masks:manage".freeze
+      MANAGE_SECURITY = "masks:manage:security".freeze
+      MANAGE_SUPPORT = "masks:manage:support".freeze
+      MANAGE_READ = "masks:manage:read".freeze
+      HANDSHAKE = "masks:handshake".freeze
+      SCIM = "masks:scim".freeze
+      SIGNALS = "masks:signals".freeze
+      DELEGATE = "masks:delegate:".freeze
+
+      DESCRIBED = {
+        OPENID => "openid",
+        PROFILE => "profile",
+        EMAIL => "email",
+        OFFLINE => "offline_access",
+        IDENTITIES => "identities",
+        ORGANIZATION => "organization",
+        GROUPS => "groups",
+        MANAGE => "manage",
+        MANAGE_SECURITY => "manage_security",
+        MANAGE_SUPPORT => "manage_support",
+        MANAGE_READ => "manage_read",
+        HANDSHAKE => "handshake",
+        SCIM => "scim",
+        SIGNALS => "signals"
+      }.freeze
+
+      STANDARD = [ OPENID, PROFILE, EMAIL, OFFLINE, IDENTITIES, ORGANIZATION, GROUPS ].freeze
+      EVERYONE = [ GROUPS ].freeze
+      PERSONAL = (STANDARD + [ MANAGE, HANDSHAKE ]).freeze
+      NAMESPACE = "masks:".freeze
+
+      class << self
+        def list(value)
+          case value
+          when nil then []
+          when Array then value
+          else value.to_s.split(/[\s,]+/)
+          end.map(&:to_s).reject(&:empty?).uniq.sort
+        end
+
+        def join(value)
+          list(value).join(" ")
+        end
+
+        def prefix?(scope)
+          scope.to_s.end_with?(":")
+        end
+
+        def covered?(available, scope)
+          return false if prefix?(scope)
+          return true if list(available).include?(scope)
+
+          list(available).any? do |entry|
+            prefix?(entry) && scope.start_with?(entry) && scope.length > entry.length
+          end
+        end
+
+        def refused(available, requested)
+          list(requested).reject { |scope| covered?(available, scope) }
+        end
+
+        def granted(requested, available)
+          list(requested).select { |scope| covered?(available, scope) }
+        end
+
+        def union(*values)
+          list(values.flat_map { |value| list(value) })
+        end
+
+        def covers?(available, requested)
+          refused(available, requested).empty?
+        end
+
+        def delegations(value)
+          list(value).select { |scope| delegated_provider(scope) }
+        end
+
+        def delegable(value)
+          list(value).select { |scope| scope.start_with?(DELEGATE) }
+        end
+
+        def delegated_provider(scope)
+          scope.to_s.delete_prefix(DELEGATE).presence if scope.to_s.start_with?(DELEGATE)
+        end
+
+        def concrete(value)
+          list(value).reject { |scope| prefix?(scope) }
+        end
+
+        def unattended(value)
+          list(value).reject { |scope| PERSONAL.include?(scope) || scope.start_with?(DELEGATE) }
+        end
+
+        def reserved(value)
+          list(value).select { |scope| scope.start_with?(NAMESPACE) }
+        end
+
+        def description_for(scope, locale: I18n.locale)
+          return I18n.t("scopes.delegates", locale: locale) if scope == DELEGATE
+
+          if prefix?(scope)
+            return I18n.t("scopes.namespace", namespace: scope.chomp(":"), locale: locale)
+          end
+
+          if (provider = delegated_provider(scope))
+            named = Provider.find_by(key: provider)&.name || provider
+            return I18n.t("scopes.delegate", provider: named, locale: locale)
+          end
+
+          key = DESCRIBED[scope]
+          return I18n.t("scopes.#{key}", locale: locale) if key
+
+          I18n.t("scopes.generic", name: scope, locale: locale)
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/sector_identifier.rb

@@ -0,0 +1,50 @@
+module Masks
+  module Server
+    module SectorIdentifier
+      class Refused < StandardError; end
+
+      OPEN_TIMEOUT = 2
+      READ_TIMEOUT = 3
+
+      class << self
+        def verify!(uri, redirect_uris)
+          held = parse(uri)
+
+          raise Refused, "must be an https URL" unless held.is_a?(URI::HTTPS)
+
+          missing = Array(redirect_uris).map(&:to_s) - declared(held)
+
+          raise Refused, "does not list #{missing.join(', ')}" if missing.any?
+
+          true
+        end
+
+        def host(value)
+          URI.parse(value.to_s).host&.downcase.presence
+        rescue URI::InvalidURIError
+          nil
+        end
+
+        private
+
+          def parse(value)
+            URI.parse(value.to_s)
+          rescue URI::InvalidURIError
+            raise Refused, "is not a URI"
+          end
+
+          def declared(uri)
+            held = JSON.parse(Outbound.fetch!(uri, open: OPEN_TIMEOUT, read: READ_TIMEOUT))
+
+            raise Refused, "must hold a JSON array of redirect URIs" unless held.is_a?(Array)
+
+            held.map(&:to_s)
+          rescue JSON::ParserError
+            raise Refused, "did not answer with JSON"
+          rescue Outbound::Refused => e
+            raise Refused, e.message
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/sender.rb

@@ -0,0 +1,173 @@
+module Masks
+  module Server
+    class Sender < ApplicationRecord
+      class Failed < StandardError; end
+
+      include TenantScoped
+      include Archivable
+
+      Field = Data.define(:key, :label, :type, :secret, :required, :options, :default, :hint)
+
+      MAIL = "mail".freeze
+      SMS = "sms".freeze
+      KINDS = [ MAIL, SMS ].freeze
+
+      self.inheritance_column = "service"
+
+      encrypts :secrets
+
+      validates :key, presence: true,
+                      uniqueness: { scope: :tenant_id },
+                      format: { with: /\A[a-z0-9][a-z0-9-]*\z/ }
+      validates :name, presence: true
+      validates :kind, inclusion: { in: KINDS }
+      validate :fields_are_filled
+      validate :options_are_offered
+
+      before_validation { self.kind = self.class.kind }
+      before_save :demote_other_primaries, if: -> { primary && archived_at.nil? }
+
+      class << self
+        attr_writer :kind, :label
+
+        def kind
+          @kind || superclass.try(:kind)
+        end
+
+        def label
+          @label || service.titleize
+        end
+
+        def service
+          name.demodulize.underscore
+        end
+
+        def field(key, label:, type: :string, secret: false, required: true, options: nil, default: nil, hint: nil)
+          own_fields << Field.new(key.to_s, label, type.to_s, secret, required, options, default, hint)
+        end
+
+        def fields
+          (superclass.respond_to?(:fields) ? superclass.fields : []) + own_fields
+        end
+
+        def own_fields
+          @own_fields ||= []
+        end
+
+        def services
+          [
+            Senders::Smtp,
+            Senders::Twilio, Senders::Vonage, Senders::Plivo, Senders::Telnyx, Senders::Sinch,
+            Senders::MessageBird, Senders::Infobip, Senders::Sns, Senders::ClickSend,
+            (Senders::SmsLog if ::Rails.env.local?)
+          ].compact
+        end
+
+        def service_for(name)
+          services.find { |klass| klass.service == name.to_s }
+        end
+
+        def sti_name
+          service
+        end
+
+        def find_sti_class(service)
+          service_for(service) || raise(ActiveRecord::SubclassNotFound, "no sender service called #{service}")
+        end
+
+        def primary(kind)
+          active.find_by(kind: kind, primary: true)
+        end
+      end
+
+      def service
+        self.class.service
+      end
+
+      def [](key)
+        field = self.class.fields.find { |held| held.key == key.to_s }
+        return nil if field.nil?
+
+        value = field.secret ? secret_values[field.key] : (settings || {})[field.key]
+
+        value.nil? ? field.default : value
+      end
+
+      def configure(values)
+        values = (values || {}).to_h.stringify_keys
+        plain = (settings || {}).dup
+        hidden = secret_values.dup
+
+        self.class.fields.each do |field|
+          next unless values.key?(field.key)
+
+          value = cast(field, values[field.key])
+
+          if field.secret
+            next if value.blank?
+
+            hidden[field.key] = value
+          else
+            plain[field.key] = value
+          end
+        end
+
+        self.settings = plain
+        self.secrets = hidden.to_json
+        self
+      end
+
+      def secrets_held
+        self.class.fields.select { |field| field.secret && secret_values[field.key].present? }.map(&:key)
+      end
+
+      def public_settings
+        self.class.fields.reject(&:secret).to_h { |field| [ field.key, self[field.key] ] }
+      end
+
+      def deliver_test(to, journey:)
+        raise NotImplementedError
+      end
+
+      private
+
+        def demote_other_primaries
+          self.class.base_class.active.where(kind: kind, primary: true).where.not(id: id).update_all(primary: false)
+        end
+
+        def secret_values
+          @secret_values = nil if @secret_source != secrets
+          @secret_source = secrets
+          @secret_values ||= secrets.present? ? JSON.parse(secrets) : {}
+        rescue JSON::ParserError
+          {}
+        end
+
+        def cast(field, value)
+          case field.type
+          when "boolean" then ActiveModel::Type::Boolean.new.cast(value) || false
+          when "integer" then value.presence && value.to_i
+          else value.to_s.strip.presence
+          end
+        end
+
+        def fields_are_filled
+          self.class.fields.each do |field|
+            next unless field.required
+            next if field.type == "boolean"
+
+            errors.add(:base, "#{field.label} is required") if self[field.key].blank?
+          end
+        end
+
+        def options_are_offered
+          self.class.fields.each do |field|
+            next if field.options.nil? || self[field.key].blank?
+
+            errors.add(:base, "#{field.label} must be one of #{field.options.join(', ')}") unless
+              field.options.include?(self[field.key])
+          end
+        end
+    end
+  end
+end

data/app/models/masks/server/senders/click_send.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Senders
+      class ClickSend < Sms
+        self.label = "ClickSend"
+
+        field :username, label: "Username"
+        field :api_key, label: "API key", secret: true
+        field :from, label: "From", required: false
+
+        def deliver(to:, body:)
+          post_json(
+            "https://rest.clicksend.com/v3/sms/send",
+            { messages: [ { source: "masks", from: sender, body: body, to: to }.compact ] },
+            "Authorization" => basic(self[:username], self[:api_key])
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/infobip.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module Senders
+      class Infobip < Sms
+        BASE = /\A[a-z0-9]+\.api(-[a-z0-9]+)?\.infobip\.com\z/
+
+        field :base_url, label: "Base URL", hint: "The host Infobip gave the account, like xxxxx.api.infobip.com."
+        field :api_key, label: "API key", secret: true
+        field :from, label: "From"
+
+        validate :base_is_infobip
+
+        def deliver(to:, body:)
+          post_json(
+            "https://#{host}/sms/2/text/advanced",
+            { messages: [ { from: sender, destinations: [ { to: to.delete_prefix("+") } ], text: body } ] },
+            "Authorization" => "App #{self[:api_key]}"
+          )
+        end
+
+        private
+
+          def host
+            self[:base_url].to_s.sub(%r{\Ahttps?://}, "").chomp("/")
+          end
+
+          def base_is_infobip
+            errors.add(:base, "Base URL must be a host under api.infobip.com") if
+              self[:base_url].present? && !host.match?(BASE)
+          end
+      end
+    end
+  end
+end